Merge pull request #2245 from lorenzozanee/fix/termux-portable-guard

fix(install): reject unsupported Android portable installs

install.sh

@@ -148,8 +148,19 @@ detect_arch() {
     esac
 }
 
+is_android() {
+  [ "$(uname -o 2>/dev/null || true)" = "Android" ] \
+    || [ -n "${TERMUX_VERSION:-}" ] \
+    || [[ "${PREFIX:-}" == /data/data/com.termux/* ]]
+}
+
 OS=$(detect_os)
 ARCH=$(detect_arch)
+if [ "$OS" = "linux" ] && is_android; then
+  echo 'error: Android/Termux cannot run the Linux portable binary (static glibc; Android kills it with "Bad system call").' >&2
+  echo "Building from source in Termux may work but is not a supported platform yet - see issue #1202." >&2
+  exit 1
+fi
 
 echo "codebase-memory-mcp installer"
 echo "  os:      $OS"

scripts/test.sh

@@ -364,6 +364,9 @@ bash "$ROOT/tests/test_language_count_contract.sh"
 echo "=== Step 0x: packaging version-metadata contract ==="
 bash "$ROOT/tests/test_version_metadata_contract.sh"
 
+echo "=== Step 0x2: installer Android/Termux guard contract (#1202) ==="
+bash "$ROOT/tests/test_install_android_guard.sh"
+
 # Step 0y: the Windows leg must not decide its verdict from an exit status that
 # the ssh/msys2_shell chain can mangle — a channel that turns 0 into 1 can turn
 # 1 into 0, and that direction reports a RED Windows leg as green. Runs

tests/test_install_android_guard.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+mkdir -p "$WORK/bin" "$WORK/home"
+cat >"$WORK/bin/uname" <<'EOF'
+#!/usr/bin/env bash
+case "$1" in
+  -s) printf '%s\n' Linux ;;
+  -m) printf '%s\n' aarch64 ;;
+  -o) printf '%s\n' Android ;;
+  *) exit 1 ;;
+esac
+EOF
+cat >"$WORK/bin/curl" <<'EOF'
+#!/usr/bin/env bash
+printf 'curl must not run for Android/Termux\n' >&2
+exit 99
+EOF
+chmod +x "$WORK/bin/uname" "$WORK/bin/curl"
+
+# The stubs must be what install.sh sees, or this test proves nothing.
+if [ "$(PATH="$WORK/bin:$PATH" uname -o)" != "Android" ]; then
+  printf 'FAIL: the uname stub is not picked up from PATH\n' >&2
+  exit 1
+fi
+
+set +e
+output=$(PATH="$WORK/bin:$PATH" HOME="$WORK/home" \
+  CBM_DOWNLOAD_URL="http://127.0.0.1:9/cbm-android-guard-test" \
+  bash "$ROOT/install.sh" --skip-config 2>&1)
+rc=$?
+set -e
+
+if [ "$rc" -eq 0 ]; then
+  printf 'FAIL: installer accepted Android/Termux\n' >&2
+  exit 1
+fi
+if ! grep -Fq 'Android/Termux' <<<"$output"; then
+  printf 'FAIL: missing Android/Termux guidance\n%s\n' "$output" >&2
+  exit 1
+fi
+if grep -Fq 'curl must not run' <<<"$output"; then
+  printf 'FAIL: installer downloaded before rejecting Android/Termux\n' >&2
+  exit 1
+fi
+
+printf 'PASS: Android/Termux is rejected before download\n'